WO2017164159A1

WO2017164159A1 - 1:n biometric authentication, encryption, signature system

Info

Publication number: WO2017164159A1
Application number: PCT/JP2017/011174
Authority: WO
Inventors: 高橋　健太
Original assignee: 株式会社日立製作所
Priority date: 2016-03-22
Filing date: 2017-03-21
Publication date: 2017-09-28
Also published as: US20180241558A1; JP2017175244A; EP3435591B1; JP6507115B2; US10680808B2; CN107925581A; CN107925581B; EP3435591A1; EP3435591A4

Abstract

A biometric authentication system is provided with a server that is equipped with: an extraction unit that extracts feature data for authentication from biometric information that has been obtained; an encoding unit that encodes the feature data for authentication to create encoded feature data for authentication; a terminal provided with a transmission unit that transmits the feature data for authentication; a database (DB) that stores encrypted authentication information; a search unit that searches the encrypted authentication information contained in the DB; a decoding unit that decodes the searched encrypted authentication information using the encoded feature data for authentication as a decoding key; and a processing unit that performs an authentication response process with respect to an authenticated user, in place of a user terminal, on the basis of the authentication information obtained through decoding. Thus, when a user uses various existing services from one or more terminals, the present invention executes convenient and safe authentication that does not require an ID to be input or a card to be presented, without limiting the combination of users and terminals, and without modifying a service server.

Description

1: N biometric authentication / encryption / signature system

The present invention relates to a system that performs processing such as authentication, encryption, and signature based on personal biometric information.

With the advancement of IT in the society as a whole, reliable identification and authentication of users in various situations such as bank ATM, online banking, card payment, web service, entrance / exit management and attendance management, use of hotels and member facilities, etc. It is becoming increasingly important. Conventionally, identification and authentication methods using passwords and ID cards have been the mainstream, but spoofing damages such as password list attacks and card counterfeiting have frequently occurred, and fingerprints and veins are more reliable and convenient authentication methods. There is an increasing expectation for biometric authentication technology that identifies and authenticates individuals based on biometric information such as faces and irises.

In addition, as the number of systems and services used increases, the number of IDs, passwords and cards that must be managed by a single user increases, which not only reduces convenience, but also enables password reuse and card theft.・ Security issues such as an increase in forgery risk have also occurred.

Against this background, attempts have been made to make various services available using only biometric authentication. For example, in the UAF standard established by the FIDO Alliance, biometric authentication was successful on the user terminal (smartphone, PC, etc.) side. In this case, a protocol is defined that performs challenge-response authentication based on public key encryption technology with a server using a secret key in the terminal. The user registers his / her own biometric information in his / her terminal in advance and creates a pair of his / her private key and public key for each service (for example, online payment, net banking, etc.) to be used. By registering the public key in each service server, each service can be used only by presenting the biometric information on its own terminal thereafter. However, in this method, the user needs to register his / her biometric information and a secret key for each service in the terminal in advance. For this reason, FIDO is based on the premise that the user occupies one or two terminals, and access to each service is performed only from this dedicated terminal. However, in ATMs, POS terminals, offices, universities, etc., one or more terminals can be shared by multiple or unspecified users, or if one user has many terminals, In cases where the user frequently replaces the terminal, the FIDO / UAF method makes the registration operation complicated (decrease in convenience) and increases the risk of leaking sensitive and sensitive information such as biometric information and secret keys ( The problem that safety is reduced) arises.

On the other hand, a technique called biometric cryptography has attracted attention as a technique for protecting biometric information to be registered and stored and greatly reducing the risk of leakage. Biometric cryptography extracts feature quantity X from biometric information at the time of registration, and adds random number information R to X to perform some kind of concealment processing, thereby creating data H called auxiliary information. The auxiliary information H is stored in a user terminal or the like. At the time of authentication, the feature quantity X ′ is extracted from the newly acquired biometric information, and R ′ is restored by performing restoration processing on the auxiliary information H using X ′. The correct random number information is restored (R = R ') only when X' is sufficiently close to X and only at that time. The algorithm is designed so that it is difficult to estimate X and R from H unless X ′ sufficiently close to X is known. By registering and collating the R value or R hash value, it is possible to authenticate with the feature X at the time of registration kept secret, and the R value or R hash value is considered as a secret key and data By performing encryption / decryption and digital signature generation processing, encryption / decryption and digital signature based on biometric information can be realized without directly holding the secret key.

-Combining biometric encryption with the FIDO / UAF standard eliminates the need to store biometric information and secret keys on the terminal side, and it is sufficient to store auxiliary information H instead. This can reduce the risk of leakage of biometric information and secret keys. However, when one or a plurality of terminals are applied to a method of sharing with a plurality of or unspecified number of users, the problem that the operation at the time of registration is complicated (convenience decreases) has been solved. Absent. In addition, the restoration process of random number information R in biometric cryptography may require complicated calculations such as error correction processes and cryptographic processes, and the restoration process for auxiliary information of a large number of users within a terminal with limited calculation capability There is also a problem that it is difficult to perform the calculation.

Also, authentication based on FIDO / UAF can only be used with service servers that comply with the standard. Even biometric cryptography can be used only on a service server that implements the authentication function. For this reason, it is not possible with the above-described technology to use a service only by biometric authentication without modifying the server for various existing online services that use existing authentication means such as password authentication and PKI authentication.

The present invention allows the user to use various existing online services from one or a plurality of terminals without limiting the combination of the user and the terminal, without modifying the service server, The purpose is to realize convenient and secure authentication using only biometric authentication without requiring card presentation. In addition, at this time, the purpose is to realize highly confidential information and sensitive information such as registered biometric information and its feature data, secret key, password, user ID, and personal information without directly storing them in the terminal or server. .

In order to solve the above-described problem, an authentication system according to the present invention encodes a sensor that acquires biometric information of a user, a feature extraction unit that extracts authentication feature data from the acquired biometric information, and authentication feature data. A user terminal comprising: a feature data encoding unit for generating authentication encoded feature data; and a transmission unit for transmitting identification request information including the authentication encoded feature data to the outside; and storing biometric encryption authentication information A search unit that searches for biometric encryption authentication information included in the DB based on the identification request information, and decrypts the encoded feature data for authentication with respect to the searched biometric encryption authentication information And the decryption processing unit that uniquely identifies the user based on the authentication information obtained by decryption, and obtained by decryption for the identified user It comprises an authentication response processor for performing an authentication response process on behalf of the user terminal based on the testimony information, the authentication server comprising, a.

According to the present invention, when using various existing online services from one or a plurality of terminals, the user can further input ID without limiting the combination of the user and the terminal, and without modifying the service server. It is possible to authenticate safely and conveniently only by biometric authentication without requiring card presentation.

It is a block diagram which shows the function structure of the Example of this invention. It is a figure which shows biometric encryption authentication information DB in the Example of this invention. It is a flowchart which shows the registration process in the Example of this invention. It is a flowchart which shows the authentication information example and biometric encryption process in the Example of this invention. It is a flowchart which shows the authentication process in the Example of this invention. It is a flowchart which shows 1: N biometric decoding process in the Example of this invention. It is a block diagram which shows the hardware constitutions of the registration terminal in the Example of this invention, a user terminal, 1: N authentication server, and a service provision server.

Hereinafter, a first embodiment of the present invention will be described with reference to the drawings.

This embodiment can be applied to a case where one or a plurality of terminals are shared by a plurality of or an unspecified number of users in ATMs, POS terminals, offices, universities, or the like. Further, the present invention can be applied to a case where a single user has a large number of terminals. Furthermore, the present invention can be applied to a case where one user frequently replaces a terminal. According to the present embodiment, in these cases, it is not necessary to present an ID, password, card, etc., only biometric information, online payment, credit payment at the store, net banking, various web services, information system User authentication and identity verification when using various services such as login and opening / closing of ticket gates can be performed.

Note that biometric information is assumed to include fingerprints, faces, irises, etc., as well as veins stretched around fingers and palms.

FIG. 1 shows the system configuration of the biometric authentication system in this embodiment. This system includes a registration terminal 100 that converts user biometric information and authentication information of various services into a secure form and registers, a user terminal 200 for the user to use various services, and a user based only on biometric information. And a 1: N authentication server 300 that performs a proxy for authentication information decryption and authentication response processing for the service of the user, a service providing server 400 that provides the service to the user via a user terminal, and Network 500 that connects the two. Here, the user terminal 200 is assumed to be a shared or personal PC, a smartphone or a tablet, a bank ATM, a POS terminal, various business terminals, or the like in an office, university, home, or the like. It is assumed that there are a plurality of user terminals having the same configuration. Registration terminal 100 may be the same terminal as user terminal 200 or may be a different terminal. The operator of the registration terminal may be the user himself / herself, or may be an operator or system administrator different from the user. The service providing server 400 may be a banking server, a payment server, various web service servers, an authentication server for an information system in a company / university, and there are generally a plurality of such servers. In this embodiment, the user authentication function (for example, password basic authentication, password digest authentication, PKI authentication, FIDO authentication, etc.) in the service providing server 400 does not need to be modified for biometric authentication and can be used as it is.

The registration terminal 100 includes a service designation function 101 for designating or selecting a service that the user wants to use only by biometric authentication, a user ID input function 102 for inputting a user ID in the service, and authentication secret information (password) for the user ID in the service Authentication secret information input (creation) function 103 that inputs or creates a private key) and a certificate creation function that creates a public key certificate corresponding to the private key when the user authentication function is PKI authentication, etc. 104, a sensor 105 that acquires biometric information for registration, a feature extraction function 106 that extracts feature data for registration from the biometric information for registration, and a feature that performs conversion to conceal the feature data for registration and creates converted feature data Conversion function 107, verification information creation function 108 for creating verification information for authentication information (details will be described later in FIG. 4), and authentication information and verification A biometric encryption function 109 for generating biometric encryption authentication information by encrypting a set of information using registration conversion feature data as a kind of encryption key based on biometric encryption technology, and the biometric encryption authentication information It comprises a registration function 110 that registers with the 1: N authentication server 300 in association with the service identifier (SID), type information of the authentication method in the service, and the like.

The user terminal 200 includes a service use function 201 for using various services, a sensor 202 that acquires biometric information for authentication, a feature extraction function 203 that extracts authentication feature data from the biometric information for authentication, and an authentication feature A feature conversion function 204 that performs conversion to conceal data and creates conversion feature data, and a user identification / authentication request from the service providing server 400 for service, performs an authentication response using the 1: N authentication server 300 Authentication response function 205.

The sensor 202 can be selected as appropriate according to the biological information to be acquired. For example, when a finger vein is used as the biological information, an imaging unit or the like that captures transmitted light that has been irradiated from a light source (not shown) and then transmitted through the finger is assumed.

1: N authentication server 300 receives biometric encryption authentication information DB 301 that stores biometric encryption authentication information in association with a service identifier (SID), authentication method type information, and the like from user terminal 200. 1: N biometric decryption function 302 that identifies a user from biometric encryption authentication information DB 301 based on the service identifier (SID) and authentication conversion feature data to be restored and restores authentication information corresponding to the service, and decryption A proxy authentication response function 303 that performs a user authentication response process for the service providing server 400 as a proxy via the user terminal 200 based on the authenticated authentication information.

The service providing server 400 includes a user information DB 401 that manages user information such as a user ID, a password or a hash value of a password, a public key, a user authentication function 402 that performs user authentication based on authentication information, and a case where authentication is successful. And a service providing function 403 that provides a service to the user terminal 200.

As mentioned above, the service here is assumed to be online payment, credit payment at the store, net banking, various web services, login to information systems, opening / closing of ticket gates, etc.

Figure 2 shows the information managed by the biometric encryption authentication information DB 301. Each record registered in the DB includes a management ID (MID) assigned by the registration terminal 100 or 1: N authentication server 300 to manage each record, and a service identifier (SID) specified by the service specification function 101. And the type of authentication method used in the service (password basic authentication, password digest authentication, PKI authentication, FIDO authentication, etc.) and biometric encryption authentication information. One record may include a plurality of biometric encryption authentication information. A plurality of records may be registered for one user.

FIG. 7 shows the hardware configuration of the registration terminal 100, user terminal 200, 1: N authentication server 300, and service providing server 400 in the present embodiment. These can be constituted by a CPU 700, a memory 701, a storage 702, an input device 703, an output device 704, and a communication device 705 as shown in the figure.

FIG. 3 is a diagram showing a registration processing flow in this embodiment.

S300 is a process in which the registration terminal 100 specifies the identifier (SID) of the service to be used and its authentication method type by the operation of the user or operator.

S301 is a process in which the registration terminal 100 receives an input of a user ID (UID).

S302 is a process in which the registration terminal 100 receives input of authentication secret information corresponding to the authentication method type in the service or creates authentication secret information. For example, password authentication accepts password input. For PKI authentication and FIDO authentication, a private key / public key pair is generated.

S303 is a process in which the registration terminal 100 creates a certificate of authentication information according to the authentication method. For example, in the case of PKI authentication, a public key certificate including a public key is created.

S304 is a process in which the registration terminal 100 acquires biometric information for registration of the user via the sensor 105.

S305 is a process in which the registration terminal 100 extracts registration feature data from the biometric information for registration.

S306 is processing in which the registration terminal 100 converts the registration feature data to create registration conversion feature data. A specific conversion example will be described later in the latter part of the description of FIG. This step makes it possible to conceal authentication feature data described later from the 1: N authentication server 300. However, the registration feature data can be kept secret without executing this step.

S307 is a process in which the registration terminal 100 gives verification information to the authentication information. A specific method will be described later with reference to FIG.

In S308, the registration terminal 100 creates biometric encryption authentication information by encrypting authentication information based on biometric encryption technology using the registration feature data as a kind of encryption key, and a service identifier (SID), authentication method This is a process of transmitting to the 1: N authentication server 300 together with the type. Details will be described later in FIG.

S309 is a process in which the 1: N authentication server 300 receives a service identifier (SID), an authentication method type, and biometric encryption authentication information, and registers a record in the biometric encryption authentication information DB 301.

FIG. 4 is a flowchart showing a specific example of authentication information and biometric encryption processing. Note that S307 and S308 in the figure are the same steps as those shown in FIG.

Various types of authentication methods are assumed. For example, in the case of password authentication (Basic authentication, Digest authentication, etc.) (authentication information example 1), the authentication information includes a user ID (UID) and a password. In the case of PKI authentication (authentication information example 2), a user ID (UID), a private key, and a public key certificate are included. In the case of FIDO authentication (authentication information example 3), a user ID (UID) and a secret key are included.

In the verification information addition step of S307, the checksum or hash value or MAC (message authentication code) is calculated for the authentication information, and is added to the authentication information as verification information.

In the biometric encryption step of S308, as described in FIG. 3, the authentication information is encrypted using the registration feature data as an encryption key to create biometric encryption authentication information.

FIG. 5 is a diagram showing an authentication processing flow in this embodiment.

S500 is a process in which the user terminal 200 receives a user service use operation, specifies a service identifier (SID), and makes a service use request to the service providing server 400 corresponding to the service identifier (SID). .

S501 is a process in which the service providing server 400 makes a user ID identification / authentication request to the user terminal 200 in response to the service use request of S500.

S503 is a process in which the user terminal 200 acquires biometric information for user authentication via a sensor.

S503 is a process in which the user terminal 200 acquires authentication feature data from the authentication biometric information.

S504 is a process in which the user terminal 200 converts the authentication feature data, creates authentication conversion feature data, and transmits it to the 1: N authentication server 300 together with the service identifier (SID). A specific conversion example will be described later with reference to FIG. This step makes it possible to conceal the authentication feature data from the 1: N authentication server 300 as well.

S505 is a decryption process when the 1: N authentication server 300 receives a service identifier (SID) and authentication feature data. Specifically, when a record matching the received service identifier (SID) is searched from the biometric encryption authentication information DB 301, and N such records exist (N ≧ 1), 1: N Perform biometric decoding. Details of this processing will be described later with reference to FIG. If this processing fails, the user terminal 200 is notified of the authentication failure. In this case, the user terminal 200 may end the authentication process or may return to step (S502) and try authentication again.

When S506 succeeds in 1: N biometric decryption of S505, the 1: N authentication server 300 uses the decrypted authentication information (user ID and authentication secret information) via the user terminal 200. Thus, the proxy authentication response is sent to the service providing server 400.

In S507, the user terminal 200 transfers the user identification / authentication request (S501) received from the service providing server 400 to the 1: N authentication server 300 and receives the proxy authentication response (S506) of the 1: N authentication server 300. This is a process of performing an authentication response by transferring to the service providing server 400. Note that the 1: N authentication server 300 may directly communicate with the service providing server 400 without using the user terminal 200 to perform the authentication response processing in S507.

S508 is a process in which the service providing server 400 receives the authentication response S507 from the user terminal 200 or the 1: N authentication server 300 and performs a user authentication process.

S509 is a process in which the service providing server 400 provides a service to the user terminal 200 when the user authentication process is successful in S508. If user authentication fails in S508, the process is terminated without providing the service. S510 is a process in which the user terminal 200 receives service provision from the service provision server 400 in S509 and uses the service when the user authentication process is successful in S508.
Hereinafter, specific examples of the feature conversion steps (S306) and (S504), the biometric encryption step (S308), and the 1: N biometric decryption step (S505) will be supplementarily described with sentences.

As an example, when the feature data is expressed as a bit string of n bit and the Hamming distance between the registration feature data and the authentication feature data is t bit (t <n) or less, it is determined that the person is the person. To do.

The registration terminal 100 and the user terminal 200 share and store n bit secret random number information r in advance.

In the feature conversion step (S306), for the registration feature data x, an exclusive OR with ry = x (+) r ((+) is a sign of exclusive OR) is calculated, and this y Is the conversion feature data for registration.

Similarly, in the feature conversion step (S504) in the authentication flow, for the authentication feature data x ', exclusive OR with rry' = x '(+) r ((+) is the exclusive OR symbol) And y is used as the conversion feature data for registration.

Here, from y (+) y ′ = (x (+) r) (+) (x ′ (+) r) = x (+) x ′ 、, the Hamming distance between y and y ′ is x, Note that it is equal to the Hamming distance between x '.

In the biometric encryption step (S308), first, an error correction code having a code length n and a minimum distance 2t + 1 is formed, and one codeword w is randomly selected therefrom. Next, auxiliary information c = y (+) w is calculated for the conversion feature data for registration y. Furthermore, k = hash (w) is calculated using an appropriate hash function h (·). This k is regarded as an encryption key, and authentication information is encrypted by using an appropriate encryption algorithm (for example, AES) to create encrypted authentication information. Then, a set of auxiliary information c and encrypted authentication information is output as biometric encrypted authentication information.

FIG. 6 is a flowchart showing details of the 1: N biometric decoding step S505.

S601 is a process in which the user terminal 200 searches the biometric encryption authentication information DB for a record (assuming that there are N records) in which the service identifier in the record matches the service identifier (SID) received from the user terminal 200. It is.

S602 is a process of decrypting the biometric encryption with the biometric encryption authentication information for each matched record and the authentication conversion feature data as the decryption key. More specifically, the auxiliary information c included in the biometric encryption authentication information is exclusive ORed with the authentication conversion feature data y ′.
w '= c (+) y' = (y (+) w) (+) (y ') = w (+) (y (+) y')
Calculate y (+) y ′ has a Hamming weight of t or less when the Hamming distance between y and y ′ is t or less, that is, when the Hamming distance between x and x ′ is t or less. Therefore, note that w 'is information with an error of t bits or less with respect to w. Next, decoding processing using an error correction code is performed on w ′. Since the minimum distance of the error correction code is 2t + 1, an error of t bits or less can be corrected correctly. Therefore, if the hamming distance between x and x ′ is equal to or less than t (that is, if biometric information to be determined to be the person is input), w can be correctly restored. That is, when the distance between the authentication encoded feature data and the registration encoded feature data is equal to or less than a predetermined value, correct authentication information is decoded. In other words, it can be said that correct authentication information is decoded when the degree of similarity between the authentication encoded feature data and the registration encoded feature data is a predetermined value or more.

If the decryption is successful and w '' is obtained, k ′ = hash (w ″) is calculated, k ′ is regarded as a decryption key, and the above encryption algorithm is used to obtain biometric encryption authentication information. Decrypt the included encrypted authentication information.

S603 is processing for generating the verification information for the decrypted authentication information in the same manner as in step (S307) and comparing it with the decrypted verification information. If the verification information matches, “success” is indicated. Further, when the error correction code decoding process itself in step (S602) fails (w ″ cannot be calculated), it is regarded as “failure” in step (S603). Note that if the hamming distance between x and x ′ is equal to or less than t, w ″ = w, k ′ = k, and “success” is obtained in step (S603).

S604 is a process for identifying the user when “success” is obtained in step (S603). In this case, the Hamming distance d (≦ t) between w and w ′ matches the Hamming distance between x and x ′. If there are a plurality of “successful” records in (S603), it is considered that the record with the smaller t ′ is more personal. Therefore, the user is uniquely identified by such a method that d is the record with the smallest d, or d is less than a certain threshold value t ′, and the first one found is the record. .

In the present embodiment, the user terminal 200 does not need to store any information created from the user's biometric information or any information constituting the user authentication information. The 1: N authentication server 300 and the service providing server 400 do not need to store any information for identifying the user terminal 200. Therefore, when using various services, the user can use any user terminal without registering or limiting user terminals to be used in advance. It is also possible to share one terminal with an unspecified number of users.

Further, when the authentication flow of the present embodiment is viewed from the service providing server 400 side, the behavior of the user terminal 200 is indistinguishable from processing in normal password authentication, PKI authentication, and FIDO authentication. Therefore, the user can use an authentication method based only on biometric information without correcting the user authentication function in the service providing server 400 or the user authentication information (password, public key, etc.) already registered in the user information DB 401. it can.

Furthermore, in the authentication flow of this embodiment, when the user uses the service, it is not necessary to present or input his / her user ID (UID) to the user terminal 200. This is because the process of specifying the user ID is executed in the 1: N authentication server 300 based on only the biometric information, and the process of presenting the user ID to the service providing server 400 is also executed on behalf of the user. . Moreover, the registration / authentication process flow is executed based on biometric encryption authentication information (including user ID and authentication secret information) and its verification information, and 1: N biometric decryption process. There is no need to directly store biometric information for registration, biometric feature data for registration, and authentication information, and such information is highly protected. This minimizes the risk of leakage of biometric information and authentication information, enabling safe and secure authentication.

100: Registration terminal 101: Service specification function 102: User ID input function 103: Authentication secret information input (creation) function 104: Certificate creation function 105: Sensor 106: Feature extraction function 107: Feature conversion function 108: Verification information creation Function 109: Bimetric encryption function 110: Registration function 200: User terminal 201: Service use function 202: Sensor 203: Feature extraction function 204: Feature conversion function 205: Authentication response function 300: 1: N authentication server 301: Biometric encryption Authentication information DB 302: 1: N biometric decryption function 303: proxy authentication response function 400: service providing server 401: user information DB 402: user authentication function 403: service providing function 500: network 700: CPU 701: memory 702 : Storage 703: Input device 704: Output device 705: Communication device

Claims

An authentication system comprising a user terminal and an authentication server connected to the user terminal via a network,
The user terminal includes a sensor that acquires user biometric information;
A feature extraction unit for extracting feature data for authentication from the acquired biometric information;
A feature data encoding unit that encodes the authentication feature data to create encoded authentication feature data;
A transmission unit for transmitting the identification request information including the authentication encoded feature data to the outside,
The authentication server includes a DB that stores biometric encryption authentication information;
A search unit for searching for biometric encryption authentication information included in the DB based on the identification request information;
A decryption processing unit that performs decryption on the retrieved biometric encryption authentication information using the authentication encoded feature data as a decryption key, and uniquely identifies the user based on the authentication information obtained by the decryption; ,
A biometric authentication system comprising: an authentication response processing unit that performs an authentication response process on behalf of the user terminal on the basis of authentication information obtained by decoding the identified user.
The biometric authentication system according to claim 1,
The biometric encryption authentication information is information obtained by encrypting the authentication information of the user using the encoded feature data for registration obtained by encoding the feature data for registration extracted from the biometric information at the time of registration of the user. Yes,
The biometric authentication system, wherein the decoding processing unit decodes correct authentication information when a similarity between the authentication encoded feature data and the registration encoded feature data exceeds a predetermined value.
The biometric authentication system according to claim 2,
When the user authentication method is password authentication, the authentication information includes password information used when the user uses the service.
The biometric authentication system according to claim 2,
When the user authentication method is a public key encryption method, the authentication information includes information on a secret key used when the user uses the service.
The biometric authentication system according to claim 2, wherein
The biometric authentication system, wherein the authentication information includes a user ID used when a user uses a service.
The biometric authentication system according to claim 2,
The authentication information includes verification information for verifying the correctness of the authentication information,
The biometric authentication system, wherein the decryption processing unit determines whether the decrypted authentication information is correct based on the verification information.
The biometric authentication system according to claim 6,
The decryption processing unit performs an error correction process and a process of determining biometric encryption authentication information with the least amount of error information corrected by the error correction process as being the correct user and associating it with the user A biometric authentication system characterized by that.
The biometric authentication system according to claim 6,
The decryption processing unit includes an error correction process, a process of determining biometric encryption authentication information in which the amount of error information corrected by the error correction process is less than a predetermined value as that of the correct user, and associating the information with the user The biometric authentication system characterized by implementing.
The biometric authentication system according to claim 7 or 8,
The DB stores the biometric encryption authentication information and the service type in association with each other,
The identification request information includes an identifier for identifying a service type,
The biometric authentication system, wherein the search unit searches biometric encryption authentication information associated with a service type based on the identifier.
A sensor that acquires user biometric information, a feature extraction unit that extracts authentication feature data from the acquired biometric information, and feature data encoding that encodes the authentication feature data to create authentication feature data And a user terminal provided with a transmission unit that transmits identification request information including the authentication encoded feature data to the outside, and connected via a network,
A DB for storing biometric encryption authentication information;
A search unit for searching for biometric encryption authentication information included in the DB based on the identification request information;
A decryption processing unit that performs decryption on the retrieved biometric encryption authentication information using the authentication encoded feature data as a decryption key, and uniquely identifies the user based on the authentication information obtained by the decryption; ,
An authentication response processing unit comprising: an authentication response processing unit that performs an authentication response process on behalf of the user terminal based on authentication information obtained by decryption for an identified user.